You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
fw-daemon/sgfw/sgfw.go

194 lines
3.6 KiB

9 years ago
package main
import (
"os"
"os/signal"
"regexp"
"sync"
"syscall"
9 years ago
"time"
"unsafe"
9 years ago
"github.com/op/go-logging"
9 years ago
"github.com/subgraph/fw-daemon/nfqueue"
"github.com/subgraph/go-procsnitch"
9 years ago
)
var log = logging.MustGetLogger("sgfw")
var logFormat = logging.MustStringFormatter(
"%{level:.4s} %{id:03x} %{message}",
)
var ttyFormat = logging.MustStringFormatter(
9 years ago
"%{color}%{time:15:04:05} ▶ %{level:.4s} %{id:03x}%{color:reset} %{message}",
)
const ioctlReadTermios = 0x5401
func isTerminal(fd int) bool {
var termios syscall.Termios
_, _, err := syscall.Syscall6(syscall.SYS_IOCTL, uintptr(fd), ioctlReadTermios, uintptr(unsafe.Pointer(&termios)), 0, 0, 0)
return err == 0
}
9 years ago
func setupLoggerBackend(lvl logging.Level) logging.LeveledBackend {
format := logFormat
if isTerminal(int(os.Stderr.Fd())) {
format = ttyFormat
}
9 years ago
backend := logging.NewLogBackend(os.Stderr, "", 0)
formatter := logging.NewBackendFormatter(backend, format)
leveler := logging.AddModuleLevel(formatter)
leveler.SetLevel(lvl, "sgfw")
return leveler
9 years ago
}
type Firewall struct {
dbus *dbusServer
dns *dnsCache
enabled bool
logBackend logging.LeveledBackend
9 years ago
lock sync.Mutex
policyMap map[string]*Policy
policies []*Policy
ruleLock sync.Mutex
rulesById map[uint]*Rule
nextRuleId uint
reloadRulesChan chan bool
stopChan chan bool
}
func (fw *Firewall) setEnabled(flag bool) {
fw.lock.Lock()
defer fw.lock.Unlock()
fw.enabled = flag
}
func (fw *Firewall) isEnabled() bool {
fw.lock.Lock()
defer fw.lock.Unlock()
return fw.enabled
}
func (fw *Firewall) clearRules() {
fw.ruleLock.Lock()
defer fw.ruleLock.Unlock()
fw.rulesById = nil
fw.nextRuleId = 0
}
func (fw *Firewall) addRule(r *Rule) {
fw.ruleLock.Lock()
defer fw.ruleLock.Unlock()
r.id = fw.nextRuleId
fw.nextRuleId += 1
if fw.rulesById == nil {
fw.rulesById = make(map[uint]*Rule)
}
fw.rulesById[r.id] = r
}
func (fw *Firewall) getRuleById(id uint) *Rule {
fw.ruleLock.Lock()
defer fw.ruleLock.Unlock()
if fw.rulesById == nil {
return nil
}
return fw.rulesById[id]
9 years ago
}
func (fw *Firewall) stop() {
fw.stopChan <- true
}
func (fw *Firewall) reloadRules() {
fw.reloadRulesChan <- true
}
9 years ago
func (fw *Firewall) runFilter() {
q := nfqueue.NewNFQueue(0)
defer q.Destroy()
q.DefaultVerdict = nfqueue.DROP
q.Timeout = 5 * time.Minute
packets := q.Process()
for {
select {
case pkt := <-packets:
if fw.isEnabled() {
fw.filterPacket(pkt)
} else {
pkt.Accept()
}
case <-fw.reloadRulesChan:
fw.loadRules()
case <-fw.stopChan:
9 years ago
return
}
}
}
var commentRegexp = regexp.MustCompile("^[ \t]*#")
func main() {
readConfig()
logBackend := setupLoggerBackend(FirewallConfig.LoggingLevel)
log.SetBackend(logBackend)
procsnitch.SetLogger(log)
9 years ago
if os.Geteuid() != 0 {
log.Error("Must be run as root")
os.Exit(1)
}
setupIPTables()
9 years ago
ds, err := newDbusServer()
9 years ago
if err != nil {
log.Error(err.Error())
os.Exit(1)
}
fw := &Firewall{
dbus: ds,
dns: NewDnsCache(),
enabled: true,
logBackend: logBackend,
policyMap: make(map[string]*Policy),
reloadRulesChan: make(chan bool, 0),
stopChan: make(chan bool, 0),
9 years ago
}
ds.fw = fw
9 years ago
fw.loadRules()
fw.runFilter()
// observe process signals and either
// reload rules or shutdown firewall service
sigKillChan := make(chan os.Signal, 1)
signal.Notify(sigKillChan, os.Interrupt, os.Kill)
sigHupChan := make(chan os.Signal, 1)
signal.Notify(sigHupChan, syscall.SIGHUP)
for {
select {
case <-sigHupChan:
fw.reloadRules()
case <-sigKillChan:
fw.stop()
return
}
}
9 years ago
}